{ config, pkgs, lib, ... }: let cfg = config.services.nextcloud; hostName = "cloud.feal.no"; in { services.nextcloud = { enable = true; package = pkgs.nextcloud29; inherit hostName; home = "/tank/nextcloud"; https = true; webfinger = true; config = { dbtype = "pgsql"; dbuser = "nextcloud"; dbhost = "/run/postgresql"; dbname = "nextcloud"; adminuser = "ncadmin"; adminpassFile = config.sops.secrets."nextcloud/adminpass".path; }; settings = { default_phone_region = "NO"; log_type = "file"; overwriteprotocol = "https"; trusted_proxies = [ "192.168.10.175" ]; # defiant # Docs: https://github.com/pulsejet/nextcloud-oidc-login oidc_login_auto_redirect = true; oidc_login_button_text = "Log in with KeyCloak"; oidc_login_client_id = "nextcloud"; oidc_login_client_secret = "dont_put_secrets_here_use_secretFile"; oidc_login_code_challenge_method = "S256"; oidc_login_end_session_redirect' = true; oidc_login_logout_url = "https://cloud.feal.no/apps/oidc_login/oidc"; oidc_login_provider_url = "https://iam.feal.no/realms/feal.no"; oidc_login_redir_fallback = true; oidc_login_attributes = { id = "preferred_username"; mail = "email"; name = "name"; login_filter = "nextcloud-roles"; }; oidc_login_filter_allowed_values = [ "nextcloud-user" ]; oidc_login_disable_registration = false; }; secretFile = config.sops.secrets."nextcloud/secretsjson".path; phpOptions = { "opcache.interned_strings_buffer" = "16"; "upload_max_filesize" = lib.mkForce "8G"; "post_max_size" = lib.mkForce "8G"; "memory_limit" = lib.mkForce "8G"; }; poolSettings = { "pm" = "ondemand"; "pm.max_children" = 32; "pm.process_idle_timeout" = "10s"; "pm.max_requests" = 500; }; }; environment.systemPackages = [ cfg.occ ]; sops.secrets."nextcloud/adminpass" = { mode = "0440"; owner = "nextcloud"; group = "nextcloud"; restartUnits = [ "phpfpm-nextcloud.service" ]; }; sops.secrets."nextcloud/secretsjson" = { mode = "0440"; owner = "nextcloud"; group = "nextcloud"; restartUnits = [ "phpfpm-nextcloud.service" ]; }; services.postgresql = { ensureDatabases = [ "nextcloud" ]; ensureUsers = [ { name = "nextcloud"; ensureDBOwnership = true; } ]; }; systemd.services."nextcloud-setup" = { requires = [ "postgresql.service" ]; after = [ "postgresql.service" ]; }; systemd.services."phpfpm-nextcloud" = { requires = [ "tank-nextcloud.mount" ]; serviceConfig = { WorkingDirectory = "/tank/nextcloud"; NoNewPrivileges = true; PrivateDevices = true; PrivateMounts = true; PrivateTmp = true; ProtectClock = true; ProtectHome = true; ProtectHostname = true; ProtectKernelLogs = true; ProtectKernelModules = true; ProtectKernelTunables = true; ProtectProc = "invisible"; ReadWritePaths = [ "/tank/nextcloud" "/run/phpfpm" "/run/systemd" ]; ReadOnlyPaths = [ "/run/secrets" "/nix/store" ]; InaccessbilePaths = [ "/tank/media" "/tank/backup" ]; RemoveIPC = true; RestrictSUIDSGID = true; UMask = "0007"; SystemCallArchitectures = "native"; SystemCallFilter = "@system-service"; CapabilityBoundingSet = "~CAP_FSETID ~CAP_SETFCAP ~CAP_SETUID ~CAP_SETGID ~CAP_SETPCAP ~CAP_NET_ADMIN ~CAP_SYS_ADMIN ~CAP_SYS_PTRACE "; }; }; }